fix(webapp): auth submit buttons answer to button[type=submit] (BEA-53) (#103)

Every server-rendered /auth form shipped a bare <button>. Browsers default
one inside a form to submit, so humans never noticed — but the conventional
automation selector matched nothing, and the e2e suite carried a "form
button" workaround at two call sites to compensate.

All five buttons (sign in, sign up, approve, send reset link, set password)
now carry an explicit type="submit", and both e2e call sites use the
standard selector. Every spec's login() routes through helpers.ts, so a
regression fails the whole run at the first sign-in.

Markup only: authlocal.go styles button by element, not by [type], so the
rendered pages are byte-identical before and after.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

internal/webapp/authcli.go

@@ -162,7 +162,7 @@ func (c *CLIAuth) pageAuth(w http.ResponseWriter, r *http.Request, req authReque
 	}
 	authPage(w, req.title, fmt.Sprintf(`<p class="lede">%s</p>
 %s%s
-<form method="post"><button>Approve</button></form>
+<form method="post"><button type="submit">Approve</button></form>
 <p class="alt">%s</p>`,
 		html.EscapeString(req.lede), whoBlock(user, r.URL.RequestURI()), rows(req.detail()...), req.note))
 }

internal/webapp/authlocal.go

@@ -721,7 +721,7 @@ func (a *BuiltinAuth) pageLogin(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button>Sign in</button></form>
+	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button type="submit">Sign in</button></form>
 %s<p class="alt"><a href="/auth/reset">Forgot password?</a></p>`,
 		url.QueryEscape(next),
 		field("Email", "email", "email", r.FormValue("email")),
@@ -787,7 +787,7 @@ func (a *BuiltinAuth) pageSignup(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button>Sign up</button></form>
+	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button type="submit">Sign up</button></form>
 <p class="alt">Have an account? <a href="/auth/login?next=%s">Sign in</a></p>`,
 		url.QueryEscape(next),
 		field("Name", "name", "text", r.FormValue("name")),
@@ -863,7 +863,7 @@ func (a *BuiltinAuth) pageReset(w http.ResponseWriter, r *http.Request) {
 <p class="alt">No email configured on this server? The link is in the server log.</p>`)
 		return
 	}
-	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button>Send reset link</button></form>
+	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button type="submit">Send reset link</button></form>
 <p class="alt"><a href="/auth/login">Back to sign in</a></p>`,
 		field("Email", "email", "email", "")))
 }
@@ -900,7 +900,7 @@ func (a *BuiltinAuth) pageResetConfirm(w http.ResponseWriter, r *http.Request) {
 }
 
 func resetForm(token, msg string) string {
-	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button>Set password</button></form>`,
+	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button type="submit">Set password</button></form>`,
 		html.EscapeString(token), newPasswordField("New password (min 8 chars)", "password"), msg)
 }
 

internal/webapp/frontend/e2e/helpers.ts

@@ -26,7 +26,7 @@ export async function login(page: Page, email: string = ADMIN) {
   await page.waitForURL(/auth\/login/);
   await page.fill('input[name="email"]', email);
   await page.fill('input[name="password"]', PASSWORD);
-  await page.click("form button");
+  await page.click("button[type=submit]");
   await page.waitForSelector("#sidebar");
   sessions.set(email, await page.context().cookies());
 }

internal/webapp/frontend/e2e/hub.spec.ts

@@ -63,7 +63,7 @@ test("join link accepts an invite after sign-in", async ({ page, browser }) => {
   await p2.waitForURL(/auth\/login/);
   await p2.fill('input[name="email"]', MEMBER);
   await p2.fill('input[name="password"]', PASSWORD);
-  await p2.click("form button");
+  await p2.click("button[type=submit]");
   await expectToast(p2, "you joined");
   await p2.waitForURL(/\/[0-9a-f-]{36}$/); // lands on the org's project
   await ctx.close();